W32/Hilin.worm is written in Visual Basic. It copies itself to mapped network drives and contains keylogging properties as well.

The worm uses Microsoft Word icon to fool users into opening it.

It then searches for Microsoft Word documents in the local harddisk and mapped network drives. These Word documents are deleted and replaced with a copy of the worm itself. It adopts the same filename as the original document and changes the extension to *.exe.